Privacy Policy
Intuitive Therapeutics Limited (“Intuitive Therapeutics”, “we”, “us”, “our”) distributes continuous glucose monitoring systems, insulin pumps and related medical technology in Aotearoa New Zealand. We are people living with diabetes, serving people living with diabetes — which means we understand exactly how personal this information is.
This policy explains what information we collect, why we collect it, who we share it with, and what you can do about it. It applies to our website, our online store, and the support we provide by phone, email and in person.
We handle personal information in accordance with the Privacy Act 2020. Where you share health information with us, we handle it to the standard set by the Health Information Privacy Code 2020, whether or not we are a “health agency” in relation to that information.
The short version. We collect what we need to get your order to you and to support you properly — and not much else. We never sell your information. We don’t ask for your diagnosis or your clinician’s details unless you want to share them so we can help you better. The apps that come with the devices we sell are run by their manufacturers, not by us, and open source systems belong to the community — your data in those systems is yours.
- Who we are and how to contact us
- Information we collect
- Health information
- How we use your information
- Who we share information with
- Sending information overseas
- Manufacturer apps, accounts and cloud platforms
- Open source systems
- Funding applications and your clinician
- Marketing and communications
- Cookies and website analytics
- How we store and protect information
- How long we keep information
- Your rights: access, correction and deletion
- Children and young people
- Privacy breaches
- Complaints
- Changes to this policy
1. Who we are and how to contact us
Intuitive Therapeutics Limited (NZBN 9429049165982) is a company incorporated in New Zealand. We are the agency responsible for the personal information described in this policy.
- NZBN: 9429049165982
- Post: PO Box 4241, Hamilton East 3247, Aotearoa New Zealand
- Email: info@intuitivetherapeutics.co.nz
- Phone: 07 808 0850
Any privacy question, access request or complaint can go to that email address and will reach the person responsible for privacy at Intuitive Therapeutics.
2. Information we collect
We collect personal information directly from you in almost every case — when you place an order, fill in a form, email or call us, report a product issue, or subscribe to our newsletter.
Contact and order information
- Your name, email address and phone number
- Delivery address, suburb, city, postcode and country
- Delivery instructions you give us
- What you ordered, when, order value and order history
- Correspondence with us, including emails, form submissions, and notes we make when we help you over the phone
Payment information
Online card payments are processed by a third-party payment provider. Your card details are entered into that provider’s secure systems and are not collected or stored by us — we receive only confirmation that a payment succeeded, along with a reference and the last few digits of the card. Where you pay by invoice or bank transfer, we hold the invoice, the payment reference and the transaction record in our accounting system.
Product issue and warranty reports
When you report a fault, we collect what we need to investigate it and to pursue a claim with the manufacturer on your behalf:
- Device serial numbers, lot or batch numbers, and dates of use
- A description of what happened and when
- Photographs or screenshots you send us
- Any related order and delivery details
Some of this information necessarily reveals something about your health — that you use an insulin pump or a glucose sensor, for example. We treat it as health information (see section 3).
Information you choose to share
You may choose to tell us about your diagnosis, your therapy, or who your clinician or clinic is, so that we can support you better. That is entirely voluntary. See section 3.
Website information
When you visit our website we collect standard technical information — IP address, device and browser type, pages viewed, and how you arrived at the site — through cookies and analytics tools. See section 11.
Information from other people
Occasionally we receive information about you from someone else — a family member ordering on your behalf, a clinician making an enquiry with your knowledge, or a manufacturer responding to a warranty claim. Where the Privacy Act requires us to tell you that we have collected information about you from someone other than you, we will do so.
3. Health information
We do not require your health information in order to sell you anything. You can buy from us, receive your order and get help with a product without ever telling us your diagnosis, your numbers, or who treats you.
Many of the people we work with do choose to share health information with us, because it makes our support genuinely better. That might include:
- The fact that you or the person you care for lives with diabetes, and what type
- Your current therapy — pump, CGM, injections, closed loop — and what has and hasn’t worked
- The name of your clinician, diabetes nurse specialist or clinic, so we can coordinate with them at your request
- Information you send us to help troubleshoot a device, which may include reports, screenshots or glucose data
Where you share health information with us:
- We use it only for the purpose you gave it to us for — supporting you, resolving a product problem, or helping with a funding pathway you have asked us to help with.
- We do not use it for marketing, and we do not use it to build a health profile of you.
- We do not disclose it to your clinician, to a manufacturer, or to anyone else without your authorisation, unless we are required by law to do so (for example, a mandatory safety report about a device — see below).
- We keep it separate from general marketing lists, and access is limited to the people at Intuitive Therapeutics who need it to help you.
- You can ask us to delete it at any time, and we will, unless we are required to keep it (see section 13).
Device safety reporting. As a supplier of medical devices we have obligations to report serious device-related incidents to the manufacturer and, where required, to Medsafe. Safety reports are made with the minimum information necessary, and we de-identify wherever we can. If a report must identify you, we will tell you.
4. How we use your information
| What we do | What we use |
|---|---|
| Take, process and deliver your order | Contact and delivery details, order details, payment confirmation |
| Answer your questions and provide training and support | Contact details, order history, anything you choose to tell us |
| Investigate a product issue and pursue a warranty claim | Issue report, serial and lot numbers, photos, order details |
| Trace devices and meet regulatory obligations, including safety reporting and recalls | Order records, device serial and lot numbers, contact details |
| Help you understand and pursue a funding pathway you have asked about | What you have told us, and your clinician’s details if you gave them to us |
| Keep accounting and tax records | Invoices, payment records, contact and billing details |
| Send you newsletters and product updates, if you have subscribed | Name and email address |
| Improve our website and understand how it is used | Analytics and cookie data, usually aggregated |
| Meet legal obligations and protect our legal position | Whatever is relevant and necessary |
We do not sell personal information. We do not trade, rent or licence mailing lists. We do not use your information for automated decision-making that produces a legal or similarly significant effect on you.
5. Who we share information with
We share personal information only where it is necessary for one of the purposes above:
- Couriers and delivery partners — your name, delivery address, phone number and delivery instructions, so your order arrives.
- Payment providers — who process your card payment directly and hold those details under their own terms.
- Manufacturers and suppliers of the devices we distribute — where a warranty claim, a replacement, a safety report or a technical escalation requires it. We share the minimum needed, which usually means the serial or lot number and a description of the fault. We will tell you if a claim requires your contact details to be passed on.
- Our service providers — the companies that host our website, run our customer relationship and email systems, store our files, and provide our accounting software. They act on our instructions and are not permitted to use your information for their own purposes.
- Our accountant and professional advisers — where required for accounting, audit or legal advice.
- Your clinician or clinic — only where you have asked us to, or clearly authorised it.
- Regulators and authorities — including Medsafe, where the law requires it, or where it is necessary to prevent or lessen a serious threat to someone’s life or health.
If we ever sell or restructure the business, personal information may transfer as part of that, and we would ensure any acquirer is bound to handle it on terms no less protective than this policy.
6. Sending information overseas
Some of the manufacturers whose products we distribute, and some of the software providers we use, are based outside New Zealand — including in Australia, the United States, the United Kingdom, the European Union, and Asia.
Before disclosing personal information to anyone overseas, we take the steps required by information privacy principle 12 of the Privacy Act 2020 — that is, we satisfy ourselves the recipient is subject to comparable safeguards, or is required by contract to protect the information to a comparable standard, or we obtain your authorisation.
Separately from anything we do: when you use a manufacturer’s app or cloud platform, you are sending your data to that manufacturer directly, often to servers outside New Zealand, under their privacy policy. See section 7.
7. Manufacturer apps, accounts and cloud platforms
The devices we distribute are used with apps and cloud platforms operated by their manufacturers — not by Intuitive Therapeutics. When you create an account and use one of those apps, you are entering a direct relationship with that manufacturer, on their terms and under their privacy policy. We are not a party to it, and we do not control or have access to your account.
This includes, for example, the app supplied with the LinX CGM, and the Medtrum TouchCare and EasyPatch applications and Medtrum’s cloud service.
Before you use one of these apps, we strongly encourage you to read its terms of use and privacy policy. In particular, understand:
- Where your data goes. Glucose readings, insulin delivery data, device events and account details are typically uploaded to the manufacturer’s cloud servers, which may be located overseas.
- Who can see it. Follower and remote-monitoring features are powerful, and they are entirely your choice. If you invite a family member, a caregiver or a clinic to follow your data, you are choosing to share your health information with them. You can normally revoke that access in the app.
- What rights you have. Access, correction, export and deletion of data held in a manufacturer’s platform are handled by that manufacturer, under their policy and the law that applies to them. We cannot delete data from their systems on your behalf, but we are happy to help you find the right contact.
- What happens on account closure. Manufacturers differ in how long they retain data after an account is closed.
If we help you set up an app — and we often do, as part of training — we may see your data on screen during that session. We don’t retain it, and we don’t create our own copy, unless you ask us to keep something to help with an ongoing issue.
Nothing in this policy limits or varies your rights against a manufacturer under their privacy policy, or vice versa. Where the two differ in relation to data held on their platform, theirs applies.
8. Open source systems
All information we provide about open source systems is for informational purposes only. We do not sell, supply, operate or endorse open source systems. They do not belong to us — they belong to the entire diabetes community, and to those who love us and who have put in the work to make all of this possible. More information and support with open source systems can be found through Nightscout New Zealand.
Open source projects such as Nightscout, AndroidAPS, xDrip+ and similar community systems are built, maintained and given away by volunteers. They are not products, they are not services we provide, and there is no company behind them collecting your data.
From a privacy point of view, that has a specific and important consequence: when you run an open source system, you host it and you control it. Your data lives in a database and on servers that you set up and that you are responsible for — not in a system operated by us. We do not receive, store, monitor or have access to data in your open source setup unless you deliberately show it to us or share access with us, and if you do, we treat what you show us as health information under section 3.
Because you control it, you also carry the responsibility for securing it — keeping your credentials and access tokens private, thinking carefully before making a site publicly readable, and understanding who you have shared access with. The community documentation covers this well, and Nightscout New Zealand can help.
9. Funding applications and your clinician
We publish information about funding pathways, including the PHARMAC Alternative Brand Allowance, as a service to the community. Applications of that kind are made by your treating clinician on your behalf — not by us, and not by you directly.
We do not submit applications, and we do not need or want your clinical file. If you ask us for help, we will generally point you and your clinician to the right process, product codes and supporting information. If you choose to send us material relating to your application, we treat it as health information under section 3 and use it only to help with that request.
10. Marketing and communications
We send service messages relating to your order — confirmations, dispatch notices, safety and recall notices — because they are part of supplying you. You cannot opt out of safety notices while you hold a device we supplied.
Newsletters and product updates are sent only if you have subscribed or are an existing customer who would reasonably expect them. Every one of them has an unsubscribe link, and unsubscribing takes effect promptly. We comply with the Unsolicited Electronic Messages Act 2007.
11. Cookies and website analytics
Our website uses cookies and similar technologies to keep your shopping cart working, remember your preferences, keep the site secure, and understand how the site is used so we can improve it. Some of these are set by third-party analytics and marketing tools.
You can block or delete cookies through your browser settings. If you block them, parts of the site — particularly the cart and checkout — may not work properly.
12. How we store and protect information
Personal information is held in our business systems, which are provided by reputable software vendors and protected by access controls, authentication and encryption in transit. Paper records, where they exist, are held securely.
Access is limited to the people at Intuitive Therapeutics who need it to do their job, and health information is limited further still. Our team understands that the people we serve are our community, and that discretion is part of the service.
No system is perfectly secure, and we cannot guarantee the security of information you send us over the internet or by email. If you would rather not email something sensitive, call us on 07 808 0850 and we will find another way.
13. How long we keep information
- Order, invoice and accounting records — at least seven years, as required by New Zealand tax and company law.
- Device traceability records (who received which device, serial and lot numbers) — for as long as required to support recalls, safety reporting and warranty obligations, which may extend beyond the life of the device.
- Warranty and issue reports — for the period needed to resolve the claim, plus a reasonable period afterwards.
- Health information you shared voluntarily — only for as long as it is needed for the purpose you gave it to us for. You can ask us to delete it sooner.
- Marketing subscriptions — until you unsubscribe, plus a record of the unsubscribe so we don’t contact you again.
When information is no longer needed for any lawful purpose, we securely delete or destroy it.
14. Your rights: access, correction and deletion
Under the Privacy Act 2020 you have the right to ask us:
- What we hold about you and to be given access to it;
- To correct it if it is wrong, or to attach a statement of correction if we disagree;
- To delete it, which we will do where we are not required to keep it for a legal or regulatory reason.
Email info@intuitivetherapeutics.co.nz. We may need to confirm your identity first, particularly for health information. We will respond as soon as we reasonably can and within 20 working days. There is no charge for a request of this kind in the ordinary course.
You are not obliged to give us any of the information described in this policy, but if you don’t give us your name and delivery address we can’t send you an order.
15. Children and young people
Many of the people who use the devices we distribute are children. Our website and store are intended for use by adults — parents, guardians and caregivers — who order on a child’s behalf.
Where information relates to a child, we deal with the parent or guardian, and we handle that information with the same care as any other health information. Young people who are able to make their own decisions about their care are welcome to deal with us directly, and we will respect their privacy in doing so.
16. Privacy breaches
If a privacy breach occurs and it is reasonable to believe it has caused, or is likely to cause, serious harm, we will notify the Office of the Privacy Commissioner and the affected people as soon as practicable, as required by Part 6 of the Privacy Act 2020.
17. Complaints
If you think we have mishandled your information, please tell us first — email info@intuitivetherapeutics.co.nz and we will look into it properly and come back to you.
If you are not satisfied with our response, you can complain to the Office of the Privacy Commissioner:
- Website: privacy.org.nz
- Phone: 0800 803 909
- Post: PO Box 10094, Wellington 6143
Complaints about a manufacturer’s app or cloud platform should go to that manufacturer in the first instance; we are happy to help you find the right contact.
18. Changes to this policy
We may update this policy from time to time. The version published on this page is the current one, and the date at the top tells you when it last changed. If we make a change that materially affects how we handle information we already hold about you, we will take reasonable steps to tell you.